RISK-BASED LICENSING

Indonesia Risk-Based Licensing for PT PMA Companies

A decision-led brief on low, medium-low, medium-high, and high-risk OSS outputs and verification consequences, built for foreign investors who need a controlled path from filing to lawful operations.

By Elara Vance Updated August 3, 2026 4-minute read

Indonesia's risk-based system links each activity to low, medium-low, medium-high, or high risk. The tier determines whether the company needs only an NIB, a Standard Certificate, verification, or a license. The conclusion must be matched to the exact KBLI, sector, location, shareholders, authority, and transaction rather than applied as a slogan. Document the legal basis, approved source data, responsible owner, filing evidence, and every unresolved condition before signing, funding, or operating. For low, medium-low, medium-high, and high-risk OSS outputs and verification consequences, rely on current official outputs and fact-specific Indonesian advice instead of guaranteed provider claims. Learn more about the core Indonesia company registration service before selecting a filing scope.

Key takeaways

Use one controlled data set for shareholder, governance, capital, address, and license inputs.
Choose the entity, KBLI, ownership model, and location before finalizing the deed.
Treat AHU incorporation, OSS licensing, tax readiness, banking, and immigration as separate evidence gates.
Keep investment value and paid-up capital separate from provider fees and recurring operating costs.

Translate the OSS risk tier into an operating gate

Indonesia's OSS framework connects each business activity to a risk tier, and the tier determines the principal licensing output. Low-risk activity uses the NIB; medium-low uses the NIB plus an unverified Standard Certificate; medium-high uses the NIB plus a Standard Certificate that must be verified; and high-risk activity uses the NIB plus a license. Sector and supporting approvals can add conditions beyond that simplified sequence.

Use the current structure in Government Regulation 28 of 2025 and BKPM Regulation 5 of 2025 . Risk is assigned to the exact KBLI, scale, product, location, and facts entered in OSS, so an incorrect classification is not a strategy. Maintain a license matrix for every project showing status, prerequisites, verification, inspections, PB UMKU, obligations, reporting, and renewal. Operational approval should follow evidence, not merely NIB issuance.

Risk outputs	Evidence	Control action
Low	NIB	Check obligations
Medium-low or high	Standard Certificate	Read verification status
High	NIB plus license	Do not operate early

Read the NIB, risk level, and operating conditions together

An NIB is a business identity and, for low-risk activity, the business license; it is not a universal authorization for every KBLI. Medium-low risk generally adds an unverified Standard Certificate, medium-high risk requires a verified Standard Certificate, and high risk requires an NIB plus a license. The actual output follows the activity, scale, location, and current sector rules.

This risk structure is set out in BKPM Regulation 5 of 2025 and the governing Government Regulation 28 of 2025 . Read the OSS output for verification status, prerequisites, obligations, and supporting PB UMKU rather than stopping at the NIB. If the premises, environmental approval, professional credential, or sector permission remains incomplete, do not treat the company as commercially ready.

OSS license status

Low risk

NIB

Action: Verify obligations attached to the activity

Medium risk

NIB plus Standard Certificate

Action: Check whether verification is required and complete

High risk

NIB plus license

Action: Do not operate before required approval

Define the operating outcome before choosing the vehicle

The entity decision should start with the first Indonesian transaction and work backwards. If the local presence will sign customer or employment contracts, issue invoices, import goods, hold a lease, or obtain operating licenses, those functions need an entity and authority model that can lawfully perform them. A mismatch at this stage affects tax, banking, licensing, and liability.

Map the planned activity against the foreign investment framework before choosing the vehicle. Presidential Regulation 49 of 2021 keeps commercial fields generally open except closed or central-government activities, while its schedules and sector rules can impose conditions. Record the activity description, customer flow, revenue flow, people, assets, and required permits in the board decision for Indonesia Risk-Based Licensing for PT PMA Companies.

Entity fit test

Local contracts

Contract parties and signing authority Select the liable Indonesian party

Local revenue

Invoice, tax, and payment flow Confirm the entity may earn and collect

Local operations

People, premises, imports, and permits Map each operating dependency

Validate the registered address and operating premises

The registered address must be genuine, usable for official correspondence, and supported by the documents required for the entity, tax, licensing, and bank workstreams. The operating site must also fit the actual activity, zoning or spatial position, building use, landlord rights, environmental needs, and sector standards. These two locations can raise different evidence questions.

Do not select an address solely because it is inexpensive or advertised as accepted for registration. Review zoning, occupancy, mail handling, license, tax, and bank requirements, and keep the lease or service agreement, location identifiers, and renewal plan. If a virtual office is used, test whether the activity and each institution will accept it before the address is entered in corporate records.

Address validation	Evidence	Control action
Registered office	Correspondence and corporate evidence	Confirm official acceptance
Operating site	Zoning, building, environmental, and sector fit	Test the actual activity
Continuity	Lease term, renewal, mail, and record access	Avoid address failure after filing

Test the company before its first commercial transaction

Legal incorporation is only one readiness state. The company may still need verified OSS outputs, sector or supporting permits, tax access, PKP analysis, accounting and invoice controls, payroll arrangements, a bank account, premises evidence, and recurring reporting ownership before it can execute the planned transaction. Each state should be independently evidenced.

Use DGT registration guidance for the tax registration workstream and Government Regulation 28 of 2025 for the licensing baseline. Build a first-transaction test covering authority, contract, invoice, tax, payment, license, delivery, accounting entry, and reporting. Do not let a certificate date become the commercial launch date unless every required control passes.

Readiness gates

Incorporated

Deed and AHU legal-entity approval

Action: Entity legally exists

Licensed and tax-ready

Applicable OSS and tax outputs

Action: Activity can proceed under conditions

Operational

Bank, people, premises, controls, and reporting

Action: First transaction can be executed

Build launch controls around the actual OSS risk output

The decision for Indonesia Risk-Based Licensing for PT PMA Companies should be approved only when the company structure, ownership position, documents, governance, capital, address, licensing, tax, banking, and responsible owners are consistent. If one of those facts remains conditional, record it as a pre-filing or pre-operation gate instead of hiding it inside a broad provider promise.

The board or founders should sign a short mandate naming the chosen route, approved source data, budget, payment limits, acceptance evidence, unresolved conditions, and first lawful transaction. That mandate gives the notary and providers clear instructions while preserving investor control over changes. Recheck current official rules immediately before filing because sector, OSS, tax, banking, and immigration requirements can change.

Frequently asked questions

What is the difference between medium-low and medium-high risk?

Indonesia's risk-based system links each activity to low, medium-low, medium-high, or high risk. The tier determines whether the company needs only an NIB, a Standard Certificate, verification, or a license. Confirm the answer against the current official rule and the company's exact deed, AHU, OSS, tax, bank, immigration, and sector facts before acting.

Which foreign shareholder documents are required?

The exact list depends on whether the shareholder is an individual or company, the document country, signatory authority, notarial acceptance, and applicable certification or translation rules. Confirm the list before execution.

Does every PT PMA use the same capital and license requirements?

No. The baseline investment and paid-up capital rules have exceptions, and sector rules may require more. OSS outputs also vary by KBLI, scale, location, and risk level.

Does company registration alone allow the business to start operating?

Not always. Legal-entity approval and an NIB are important outputs, but the activity may still require a verified Standard Certificate, a license, supporting PB UMKU, premises evidence, tax activation, or another sector condition. Read the status and obligations attached to the exact KBLI before the first commercial transaction.

Is paid-up capital the same as a registration fee?

No. Paid-up capital belongs to the company as shareholder equity and must be documented and used consistently with current rules. Provider fees, official charges, translations, address costs, and operating expenses are separate. Never transfer a capital amount to an agent merely because an invoice calls it a setup fee.

Official references